MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d789a675b16eca7a3d78fffd03d6dfc18a396d6eac4da2472b99700ff1cb09c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d789a675b16eca7a3d78fffd03d6dfc18a396d6eac4da2472b99700ff1cb09c7
SHA3-384 hash: 38f31c19c8f149c9647a2fd5b582a612209f96765bec4a19b90f127494cf977ae0181ebdc9df0ee0a8e112ed800acc34
SHA1 hash: b0bf8fde00073a0dc5e91416223907954065b250
MD5 hash: a235c71c9675b191d6ca449b905501c6
humanhash: twelve-mirror-purple-echo
File name:EPDA - MT ALPHA MARINE.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:371'696 bytes
First seen:2020-06-26 05:40:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:LPCganNe8wDejU1TWATT5MLgCH6NFafy8/0zh2IfyPI3CcoGkEoQAgjITMZyoECP:5anUtDJxuLgNNF4CVDDoUTjITM8oEP8d
Threatray 4'706 similar samples on MalwareBazaar
TLSH 0E8422912B55E8ABC17206F16AFBDBB49E365E856680874B33C13F6F7C36B42410F291
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/14566/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d789a675b16eca7a3d78fffd03d6dfc18a396d6eac4da2472b99700ff1cb09c7/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 05:42:06 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=26e2m5nrn3fhuply776qhvw7ygfds3lovrg2erzltfya74olbhdq._file
Verdict:
malicious
Similar samples:
3188ff8a40a461c9e4e386a62daefbe7033034a0c28cfb2b02c20874b7f53b92
Formbook
336024c1299d7903a83d3dc3f1575349d747c883fcfd29d014931c3887101c45
Formbook
5845f8c6a360994b9315ad2e8abbb041a55f4653b6dfc704730202e8c8caf692
Formbook
5a0715de8860e50b6f80a1a1cd245d6133d6b3a15bfce756b46458efd8abd8ab
Formbook
c7949573443efdf9faf7bdd96422dd515bc3576d8fce3091776333047524d1a2
Formbook
d4405060b30fab298c2747fc58ec301dfa160be2df3e335a78900fac044a2493
Formbook
da3df2183f6a67da735b65864f2a91df95c96efe5526842821655449f94d2717
Formbook
e09725931c810fdc4e6c957dc80267e520c513813498078bbd646e5874e34ab2
Formbook
e99c6ae5a08e119d151f0c28b6b164d98ca6fd24d1d91b6f57bdf40f3d688c91
Formbook
f69e7749b6798b4c4f258eebbedc77992536cc24bef9d1bf3d68315ad16abcf0
Formbook
+ 4'696 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
persistence
Link:
https://tria.ge/reports/200626-yqqdv8tkhs/
Behaviour
Modifies service
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_formbook_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj f663a4ad9cc36251114439048169dca1ecd66ce8332eff691133ce718ea4d6ec

Formbook

Executable exe d789a675b16eca7a3d78fffd03d6dfc18a396d6eac4da2472b99700ff1cb09c7

(this sample)

  
Dropped by
MD5 677b6b5e69dcae8f3b221d461f3c3127
  
Dropped by
SHA256 f663a4ad9cc36251114439048169dca1ecd66ce8332eff691133ce718ea4d6ec
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/14566/

Comments